Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media
📖 What This Means
This practice requires encrypting any digital media (like USB drives, hard drives, or cloud storage) that contains Controlled Unclassified Information (CUI) so unauthorized people can't read it if the media is lost or stolen. Think of it like putting a lock on a filing cabinet – even if someone gets the cabinet, they can't access the documents without the key. For example, if an employee loses an unencrypted USB drive with CUI during travel, anyone could access the data. But if it's encrypted, the data remains protected. Another example: Storing CUI in an unencrypted cloud folder exposes it to hackers, while encryption adds a critical layer of security.
🎯 Why It Matters
Unencrypted CUI on digital media is a top cause of data breaches in defense contracting. A 2022 DoD report found 63% of CUI leaks involved unencrypted portable devices. The average cost of a breach involving CUI exceeds $250,000 in investigation/remediation. Real-world example: A defense contractor lost an external hard drive with unencrypted technical drawings for a missile system during transit, leading to a $1.2M DoD fine. The CMMC requires this control because encryption is the last line of defense when physical controls fail. Even if media is lost/stolen, properly implemented crypto prevents data exposure.
✅ How to Implement
- 1. Enable encryption-at-rest for all storage services (e.g., AWS S3 SSE, Azure Storage Service Encryption)
- 2. Configure customer-managed keys (CMK) using AWS KMS or Azure Key Vault (avoid default platform-managed keys)
- 3. Apply encryption to backups/snapshots (e.g., AWS EBS snapshots with KMS encryption)
- 4. Enforce encryption policies via IAM (e.g., AWS S3 bucket policy denying unencrypted uploads)
- 5. Document encryption methods in cloud security plans
- 6. Test restoration from encrypted backups quarterly
- 7. Monitor for unencrypted resources with AWS Config or Azure Policy
📋 Evidence Examples
Encryption Policy Document
BitLocker Compliance Report
Cloud Storage Encryption Screenshot
Decryption Test Results
Encryption Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MP.L2-3.8.6 ("Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how CUI on media is protected throughout its lifecycle, including encryption, access controls, marking, transport procedures, sanitization methods, and accountability tracking. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MP.L2-3.8.6 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to implement cryptographic mechanisms to protect the confidentiality of cui stored .... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MP.L2-3.8.6 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to implement cryptographic mechanisms to protect the confidentiality of cui stored .... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MP.L2-3.8.6 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all removable media types within the CUI boundary
- • Document media storage locations (on-site, off-site)
- • Specify media sanitization and destruction methods
- • Ensure this control covers all systems within your defined CUI boundary where implement cryptographic mechanisms to protect the confidentiality of cui stored on digital media applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Media Protection Policy
- 📄 Media inventory database
- 📄 Certificates of destruction
- 📄 Transport chain-of-custody records
- 📄 Evidence artifacts specific to MP.L2-3.8.6
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will check for CUI markings on media, verify encryption is enabled, review the media inventory for completeness, and examine destruction certificates.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do we have a documented policy specifying encryption requirements for all digital media containing CUI?
Question 2: Are all workstations/servers handling CUI encrypted with FIPS-validated full-disk encryption?
Question 3: Are all removable media (USB drives, external HDDs) encrypted before storing CUI?
Question 4: Do we have quarterly verification that cloud storage containing CUI has encryption-at-rest enabled?
Question 5: Can we demonstrate successful decryption/recovery of CUI from backups during last test?
⚠️ Common Mistakes (What Auditors Flag)
1. Encrypting data but storing keys on same media
2. Using deprecated algorithms (e.g., DES, RC4)
3. No documentation of decryption procedures
4. Encrypting only some CUI media types
5. Cloud storage encrypted but with platform-managed keys
📚 Parent Policy
This practice is governed by the Media Protection Policy